SEBI’s AI audit push forces India’s financial sector into uncharted compliance territory: Analysis

More than half of every rupee traded on India’s largest stock exchange is now moved by a machine. And in the futures and options segment, algorithmic systems accounted for 97 per cent of foreign investors’ profits in FY2024, according to a SEBI study on algorithmic trading published in September 2024, a figure that captures just how completely automated execution has taken over Indian financial markets.

For the first time in data going back over a decade, algorithmic systems crossed 50 per cent of cash market turnover on the NSE in FY25, according to its own Market Pulse data. That gap, between the pace of AI adoption and the maturity of compliance infrastructure, is precisely what India’s market regulator is now moving to close.

“The biggest shift is from whether an AI system is operating correctly to whether a firm can demonstrate explanations, accountability, good data governance and regulatory compliance for those systems,” said Adv. Varun Singh, Managing Partner at Foresight Law Offices, in an interaction with WION. “Firms in regulated markets risk reputational damage and investor lawsuits due to insufficient AI governance.”

The compliance deficit

The problem is not the technology itself. It is the absence of structured oversight around it.

“Approximately 20 to 30 per cent of financial institutions in India utilise AI, and most are currently following an uncoordinated compliance process,” Varun Singh told WION. “Firms need to transition to an integrated model, design, adopt, and implement oversight, audit, and assessment procedures.”

The Securities and Exchange Board of India's consultation paper, released on June 20, 2025 and titled “Guidelines for Responsible Usage of AI/ML in Indian Securities Markets”, sets that transition in motion. Built on six principles, ethics, accountability, transparency, auditability, data privacy, and fairness, the framework requires all regulated entities, from market infrastructure institutions to mutual funds, to put in place board-approved AI governance frameworks backed by independent audits and demonstrable model explainability.

It also explicitly acknowledges the scale of the problem it is attempting to govern: automated systems already account for roughly 50 to 55 per cent of Indian cash market volumes, a figure that has only grown as algorithmic and AI-driven execution has moved from the preserve of institutional players to a tool increasingly available to retail investors.

Where liability lives, and doesn’t

The EU AI Act, which came into force in August 2024, addresses this directly. It assigns distinct, tiered obligations to AI system providers and to deploying entities, and requires documented human oversight throughout an AI system’s lifecycle. Singapore’s Monetary Authority, under its FEAT Principles, goes further, mandating internal accountability committees to monitor AI fairness, ethics, and transparency on a continuous basis. Both frameworks answer the question of who is responsible before something goes wrong.

SEBI’s paper does not. It requires governance frameworks without specifying where liability falls when those frameworks fail. That silence is not a minor gap, it is the central unresolved question for every regulated entity now building AI infrastructure under the assumption that compliance will protect them.

The consultation paper does not specify whether liability rests with the AI developer, the deploying institution, or the board. It is also silent on the precise form of human oversight required, whether that means a Human-In-The-Loop, Human-On-The-Loop, or Human-In-Command model.

This silence sits in direct tension with Section 166(3) of the Companies Act, 2013, which already requires directors to act with due and reasonable care, skill, and diligence. As AI-driven decisions increasingly displace human ones at the point of execution, that fiduciary duty does not disappear.

“Regulated entities and members of management will remain liable for market disruptions resulting from failures in governance, data sets, or human oversight,” Varun Singh said. “Institutions will be required to maintain proper audit trail documentation and adequate explainability protocols, and also document procedures for escalating potential regulatory violations.”

A global wave

India’s regulatory reckoning mirrors pressure building across financial systems worldwide. In November 2024, the Financial Stability Board identified four AI-related vulnerabilities with the potential to amplify systemic risk: concentration in third-party service providers, market correlations, cyber risks, and failures in model risk and data governance. The FSB explicitly called on national authorities to assess whether existing frameworks were adequate, before the risks crystallised.

The concern is not theoretical. The 2010 US Flash Crash, in which cascading interactions among unmonitored high-frequency trading algorithms briefly wiped out an estimated one trillion dollars in market value, remains the defining cautionary benchmark. Closer to home, SEBI's own enforcement action in the OPG Securities colocation case exposed how opaque algorithmic access could exploit structural blind spots in Indian markets.

What firms must do now

Varun Singh's prescription is unambiguous, "Institutions that establish explainable AI protocols, data lineage tracking, and incident escalation mechanisms early will be better positioned to mitigate regulatory, operational, and litigation risks. The adoption of integrated frameworks will embed explainability, cybersecurity resilience, and vendor risk control early in their operations."

Mandatory audits, model validation cycles, and stress-testing of autonomous trading systems are the floor, not the ceiling, of what regulators will expect. As compliance risk overtakes pure technology risk in the calculus of institutional liability, building governance infrastructure is no longer optional, it is fiduciary.

For India's financial sector, the audit era has arrived. The only remaining question is how many firms will be ready for it.